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Employers and employees are currently in the process of implementing, or preparing to 
implement a phased return to work as part of the Government's ‘roadmap for reopening 
society and business’. In order to support employers and employees with this initiative, 
the Department of Business, Enterprise and Innovation (“the DBEI”) and the Department 
of Health recently published a Return to Work Safely Protocol (“the Protocol”). The DBEI 
has also recently published explanatory guidance to support employers where the 
implementation of measures recommended by the Protocol result in the processing of 
personal data. 


The purpose of this guidance document is to provide advice to employers on the 
implementation of the recommendations of the Protocol in a manner that complies with 
their obligations as data controllers under the GDPR and Data Protection Act, 2018. 


Contact Tracing Logs 


The Protocol recommends that employers keep a log of contact/group work to facilitate 
contact tracing. The DBEl’s explanatory guidance clarifies that: 


“A Log of Contact/Group Work should be maintained by Employers for Workers who 
are in close contact for extended periods of the work shift (e.g. working together in 
spaces where social distancing guidelines may be difficult to maintain). The meaning of 
close contact here should be based on guidance issued by the Public Health 
Authorities.” 


The DBEI’s explanatory guidance further clarifies that the purpose of the contact-tracing 
log is to facilitate the HSE’s official contact-tracing procedures and to act as amemory aid 
for employees in providing relevant information relating to close contacts in the event of 
a COVID-19 diagnosis. Personal data held in a contact log should generally not be 
processed by an employer for any other purpose. Employers should avoid disclosing 
information relating to a particular employee’s COVID-19 diagnosis to other employees. 
The data should be retained only for as long as considered necessary for this purpose. 
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Return to Work Form 


The Protocol recommends that employers establish and issue a pre-return to work form 
for employees to complete at least three days in advance of their planned return to work. 
The DBEI's explanatory guidance clarifies the objective of the form as follows: 


“The purpose of this Form is to highlight to Workers the symptoms of COVID-19 before 
they enter the Workplace and potentially put themselves or others at risk of infection, 
and to allow Employers to make informed decisions about employee's return to the 
workplace.” 


Return to work forms should be tailored such that they collect the minimum information 
necessary to achieve the above objective and should generally not be processed for any 
other purposes. The DBEI explanatory guidance advises that the form should not be 
retained once an employee has returned to the workplace. 


Temperature Testing 


The Protocol recommends that employers implement temperature testing “in line with 
Public Health advice”. The DBEI's explanatory guidance clarifies that: 


“This measure should only be introduced by Employers in line with Public Health advice. 
The recording of temperature checks with the names or images of Workers is not 
required. The purpose of taking a Worker's temperature is to let the Worker know if 
they have a raised temperature which is one of the symptoms of possible COVID-19 
infection. Temperature testing should only be conducted in line with current public 
health advice.” 


The DPC is not aware of any current Public Health advice recommending the 
implementation of temperature testing in the workplace. Accordingly, temperature 
testing should not be considered a requirement of the Protocol at this time. 


Employers currently considering the implementation of temperature testing as a COVID- 
19 response measure, perhaps in the context of a particularly high-risk workplace and in 
response to a particular risk that has been identified, must be in a position to justify why 
any consequent processing of personal data is necessary for the purpose of mitigating 
against the identified risk. In general, the advice of the public health authorities, in this 
respect, will be a key element in the assessment of the necessity and proportionality of 
the implementation of such a measure. Where such measures are under consideration, 
employers should remember to consider whether a Data Protection Impact Assessment 
(“DPIA”) might need to be carried out before any personal data is processed in 
conjunction with the measure. Further information on DPIAs can be found here. 
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Legal Basis for Processing 


When processing personal data, in the context of implementing the measures 
recommended by the Protocol or otherwise, an employer must have a ‘legal basis’ for 
doing so (by reference to the options set out in Article 6 GDPR). When processing special 
category personal data such as data relating to an employee's health, an employer must 
also be able to satisfy one of the requirements of Article 9 GDPR. Detailed guidance on 
the lawfulness of processing can be found here. 


Consent is unlikely to constitute a suitable legal basis for the majority of processing 
operations concerning employee data in the workplace. Where an employee has no real 
choice in the matter, because, for example, his/her personal data is going to be processed 
in connection with a measure that is introduced to meet a legal obligation or for public 
health reasons, then the employee is not in a position to decline consent and, accordingly, 
consent is not an appropriate legal basis for the processing in question. 


Employers have a legal obligation, under the Safety, Health and Welfare at Work Act, 2005 
(“the 2005 Act”), to ensure the health and safety of individuals in the workplace. Itis a 
matter for an individual employer to identify what measures should be implemented in 
the workplace so as to mitigate any risks that have been identified further to a risk 
assessment. Where the implementation of a measure necessitates the processing of 
personal data, an employer may be able to rely on Article 6(1)(c) GDPR to support the 
processing, but only if the processing is necessary for compliance with the employer's 
obligations pursuant to the 2005 Act. 


Where the implementation of a measure necessitates the processing of special category 
data, an employer may be able to rely on Article 9(2)(b) GDPR to support the processing, 
but only if the processing is necessary for the purpose of carrying out its obligations in 
the field of employment (such as the obligations arising under the 2005 Act). 


When considering whether Article 6(1)(c) and/or Article 9(2)(b) might provide a suitable 
legal basis for the processing of personal data in a health and safety context, employers 
should remember that any processing of personal data should be limited to that which is 
necessary to achieve the objective being pursued. In addition, the processing must 
comply with all of the principles of data protection as set out in Article 5 GDPR. Further 
information on the application of these principles can be found here. 


In circumstances where employers act under the direction of public health authorities, or 
other relevant authorities where national measures are undertaken to protect against 
COVID-19, Article 6(1)(e) and Article 9(2)(i) GDPR and Section 53 of the Data Protection Act 
2018 may permit the processing of personal data, including health data, where it is 
deemed both necessary and proportionate, and once suitable safeguards are 
implemented. Such safeguards may include limitation on access to the data, strict time 
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limits for erasure, and other measures such as adequate staff training to protect 
employees’ data protection rights. 


